容器、编排与基础设施即代码
Containers, orchestration & IaC
Write or fix Dockerfiles, Compose/Kubernetes manifests and Terraform to a working deployment.
20 条本项目编写的提案 · 分类 v1.1 · 新增基准运行 0 次。下方验证方式与部分得分规则是设计，不是执行结果。
- 典型应用
- Docker · kubectl · Terraform
- 小类 GUI 需求标签
CL· CLI 足够
任务提案 · 20
展开查看完整原文与建议检查方式；两种界面均保留提案英文原文。
R03.04.01.01-T01 Write a small, non-root multi-stage Dockerfile for a Node app
原始指令
Containerize app/ (Node 20 + TypeScript API) with a multi-stage Dockerfile: build stage compiles, runtime stage contains only production dependencies and dist/, runs as a non-root user, exposes 8080 and defines a HEALTHCHECK on /healthz. Final image must be under 150 MB.
- 平台
lin· Linuxmac· macOSwin· Windows- 应用
- Docker
- 交互表面
term· 终端- GUI 需求 · 任务设定
CL· CLI 足够- GUI 需求 · 普通权限
CL· CLI 足够- 交互原语
code· 代码与命令- 工作产物
WP06· 代码 / 工程- 条件
- 未声明
- 提案难度
- 2 / 5
建议验证方式
Grader builds the image: size <150 MB; docker inspect User non-root; HEALTHCHECK present and container becomes healthy; GET /api/items returns 200 with expected JSON; no devDependencies in the image (npm ls --prod check).
建议部分得分
25% builds and serves; 25% size; 20% non-root; 30% healthcheck and no dev deps
R03.04.01.01-T02 Compose a four-service stack with health-gated startup
原始指令
Write compose.yaml for the app in stack/: web (build from ./web), api (build ./api), Postgres 16 with a named volume and init SQL, and Redis. api starts only after Postgres and Redis are healthy; web only after api is healthy; secrets come from .env.
- 平台
lin· Linuxmac· macOSwin· Windows- 应用
- Docker Compose
- 交互表面
term· 终端- GUI 需求 · 任务设定
CL· CLI 足够- GUI 需求 · 普通权限
CL· CLI 足够- 交互原语
code· 代码与命令- 工作产物
WP06· 代码 / 工程- 条件
- 未声明
- 提案难度
- 2 / 5
建议验证方式
Grader runs docker compose up -d --wait: all 4 healthy; GET web /status shows db and cache OK; restart of postgres preserves data (volume); depends_on uses condition service_healthy (YAML check); no secrets inline.
建议部分得分
40% stack healthy and working; 25% health-gated ordering; 20% persistence; 15% secrets from env
R03.04.01.01-T03 Deploy an app to Kubernetes from a written spec
原始指令
Write manifests in k8s/ for the 'orders' service per spec/orders.md: Deployment (3 replicas, resources, probes), Service, Ingress at orders.local, ConfigMap for settings and a Secret for DB credentials. Apply to the provided kind cluster so the service is reachable through the ingress.
- 平台
lin· Linuxmac· macOS- 应用
- kubectl · kind
- 交互表面
term· 终端- GUI 需求 · 任务设定
CL· CLI 足够- GUI 需求 · 普通权限
CL· CLI 足够- 交互原语
code· 代码与命令- 工作产物
WP08· 应用 / 系统状态- 条件
- 未声明
- 提案难度
- 3 / 5
建议验证方式
Grader: kubectl get shows 3 ready pods; curl via ingress returns 200 with config value from the ConfigMap; env var from Secret (not literal); resources and probe settings match spec (kubeconform + YAML assertions).
建议部分得分
40% workload ready and reachable; 20% config/secret wiring; 25% spec fields; 15% schema valid
R03.04.01.01-T04 Fix a CrashLoopBackOff caused by a bad secret reference
原始指令
In the kind cluster, deployment 'billing' in namespace payments is in CrashLoopBackOff. Diagnose it with kubectl, fix the manifests in k8s/billing/ (not by editing live objects only), and re-apply so all pods run.
- 平台
lin· Linuxmac· macOS- 应用
- kubectl · kind
- 交互表面
term· 终端- GUI 需求 · 任务设定
CL· CLI 足够- GUI 需求 · 普通权限
CL· CLI 足够- 交互原语
code· 代码与命令- 工作产物
WP08· 应用 / 系统状态- 条件
- 未声明
- 提案难度
- 2 / 5
建议验证方式
Seeded cause: secretKeyRef key name mismatch plus a missing ConfigMap key. Grader: pods Running and Ready for 5 min with 0 restarts after fix; manifests in repo contain the fix (re-apply on a fresh cluster works).
建议部分得分
40% root cause fixed in manifests; 40% pods healthy; 20% reproducible on fresh cluster
R03.04.01.01-T05 Author a Helm chart with a values schema and tests
原始指令
Package the 'notify' service as a Helm chart in charts/notify/: templated Deployment, Service, optional Ingress and HPA toggled by values, values.schema.json validation, NOTES.txt, and a helm test pod that calls /healthz.
- 平台
lin· Linuxmac· macOS- 应用
- Helm · kubectl
- 交互表面
term· 终端- GUI 需求 · 任务设定
CL· CLI 足够- GUI 需求 · 普通权限
CL· CLI 足够- 交互原语
code· 代码与命令- 工作产物
WP06· 代码 / 工程- 条件
- 未声明
- 提案难度
- 3 / 5
建议验证方式
Grader: helm lint clean; helm template with 4 value sets matches expected objects; invalid values rejected by schema; helm install on kind succeeds and helm test passes.
建议部分得分
30% templates per value sets; 25% schema rejects invalid; 25% install + test; 20% lint/NOTES
R03.04.01.01-T06 Provision a VPC and load balancer with Terraform on LocalStack
原始指令
Write Terraform in infra/ that creates on LocalStack: a VPC with 2 public and 2 private subnets across 2 AZs, NAT gateway, an ALB in the public subnets with an HTTPS listener (self-signed cert from certs/), and a target group. It must pass terraform validate, plan cleanly and satisfy policies/*.rego.
- 平台
lin· Linuxmac· macOS- 应用
- Terraform · LocalStack · OPA
- 交互表面
term· 终端- GUI 需求 · 任务设定
CL· CLI 足够- GUI 需求 · 普通权限
CL· CLI 足够- 交互原语
code· 代码与命令- 工作产物
WP06· 代码 / 工程- 条件
- 未声明
- 提案难度
- 4 / 5
建议验证方式
Grader: terraform apply against LocalStack succeeds; describe calls show subnets/AZs/routes as specified; conftest on the plan JSON passes all policies (no 0.0.0.0/0 on private SGs, tags required); second plan shows no changes.
建议部分得分
35% resources correct; 30% policies pass; 20% idempotent re-plan; 15% validate/fmt
R03.04.01.01-T07 Refactor Terraform into modules without destroying anything
原始指令
infra/legacy/ manages 34 resources (LocalStack) in one flat main.tf. Refactor into modules network/, compute/ and storage/ using moved blocks so that terraform plan after the refactor shows zero destroys and zero creates.
- 平台
lin· Linuxmac· macOS- 应用
- Terraform · LocalStack
- 交互表面
term· 终端- GUI 需求 · 任务设定
CL· CLI 足够- GUI 需求 · 普通权限
CL· CLI 足够- 交互原语
code· 代码与命令- 工作产物
WP06· 代码 / 工程- 条件
risk· 高风险 / 不可逆- 提案难度
- 4 / 5
建议验证方式
Grader runs plan on the refactored code against the existing state: 0 to add, 0 to destroy (moves only); module structure present; resource IDs in LocalStack unchanged after apply.
建议部分得分
50% plan has no add/destroy; 30% module structure; 20% resource IDs unchanged
R03.04.01.01-T08 Build Kustomize overlays for three environments
原始指令
Create a Kustomize base and overlays dev, staging and prod for the app in k8s/app/ per spec/envs.md: replica counts, image tags, resource limits, an extra sidecar only in prod, environment-specific ConfigMap generators, and a namespace per overlay.
- 平台
lin· Linuxmac· macOS- 应用
- Kustomize · kubectl
- 交互表面
term· 终端- GUI 需求 · 任务设定
CL· CLI 足够- GUI 需求 · 普通权限
CL· CLI 足够- 交互原语
code· 代码与命令- 工作产物
WP06· 代码 / 工程- 条件
- 未声明
- 提案难度
- 3 / 5
建议验证方式
Grader runs kustomize build for each overlay and compares normalized output to expected manifests; prod includes the sidecar, others do not; generated ConfigMap name hashes referenced correctly.
建议部分得分
60% three overlays match (20 pts each); 20% sidecar patch; 20% config generators
R03.04.01.01-T09 Migrate a docker-compose app to Kubernetes with Helm and Terraform
原始指令
Migrate the 6-service compose app in legacy/ to Kubernetes: Terraform creates the kind cluster, namespaces and an S3 bucket (LocalStack); Helm charts deploy the services with probes, resources and secrets. All images must have no CRITICAL vulnerabilities in Trivy scans.
- 平台
lin· Linux- 应用
- Terraform · Helm · kubectl · Trivy
- 交互表面
term· 终端- GUI 需求 · 任务设定
CL· CLI 足够- GUI 需求 · 普通权限
CL· CLI 足够- 交互原语
code· 代码与命令- 工作产物
WP08· 应用 / 系统状态- 条件
long· 长流程- 提案难度
- 5 / 5
建议验证方式
Grader runs terraform apply and helm install from scratch: all services ready; end-to-end smoke test (scripts/smoke.sh) passes; trivy image reports 0 CRITICAL for every image; no plaintext secrets in charts.
建议部分得分
20% Terraform infra; 35% services deployed and healthy; 25% smoke test; 20% Trivy clean
R03.04.01.01-T10 Autoscale a deployment under load with an HPA
原始指令
Configure resource requests and an HPA (CPU 60%, 2–10 replicas, scale-down stabilization 120 s) for deployment 'search' in the kind cluster with metrics-server, so that under the provided load test p95 latency stays below 300 ms.
- 平台
lin· Linuxmac· macOS- 应用
- kubectl · kind
- 交互表面
term· 终端- GUI 需求 · 任务设定
CL· CLI 足够- GUI 需求 · 普通权限
CL· CLI 足够- 交互原语
code· 代码与命令- 工作产物
WP08· 应用 / 系统状态- 条件
- 未声明
- 提案难度
- 4 / 5
建议验证方式
Grader runs the 10-minute load profile: replicas scale up to ≥5 then back down after load stops (after ≥120 s); p95 latency <300 ms during the load; HPA spec matches.
建议部分得分
30% HPA spec; 35% scaling behavior; 35% latency target
R03.04.01.01-T11 Restrict pod traffic with NetworkPolicies
原始指令
In namespace shop on the kind cluster (Calico), write NetworkPolicies so only: frontend → api on 8080, api → db on 5432, api → redis on 6379, all pods → kube-dns, and ingress-nginx → frontend. Everything else must be denied.
- 平台
lin· Linuxmac· macOS- 应用
- kubectl · Calico
- 交互表面
term· 终端- GUI 需求 · 任务设定
CL· CLI 足够- GUI 需求 · 普通权限
CL· CLI 足够- 交互原语
code· 代码与命令- 工作产物
WP08· 应用 / 系统状态- 条件
- 未声明
- 提案难度
- 3 / 5
建议验证方式
Grader runs a connectivity matrix (20 source/destination/port probes): allowed paths succeed, all others time out; DNS resolution works; default-deny policy present.
建议部分得分
70% connectivity matrix correct; 15% DNS works; 15% default deny
R03.04.01.01-T12 Configure three hosts with an idempotent Ansible playbook
原始指令
Write an Ansible playbook and roles in ansible/ that configure the three provided VMs: nginx reverse proxy with TLS (certs in files/), a systemd service for the app binary, ufw allowing only 22/443, and logrotate. A second run must report zero changes.
- 平台
lin· Linux- 应用
- Ansible
- 交互表面
term· 终端- GUI 需求 · 任务设定
CL· CLI 足够- GUI 需求 · 普通权限
CL· CLI 足够- 交互原语
code· 代码与命令- 工作产物
WP08· 应用 / 系统状态- 条件
- 未声明
- 提案难度
- 3 / 5
建议验证方式
Grader runs the playbook twice: second run changed=0; on each host curl https://host/health returns 200 via nginx; ufw status shows only 22/443; service enabled; ansible-lint clean.
建议部分得分
40% hosts configured correctly; 25% idempotent; 20% firewall; 15% lint
R03.04.01.01-T13 Deploy a serverless API with Pulumi on LocalStack
原始指令
Using Pulumi (Python), deploy to LocalStack an S3 bucket, a Lambda (Python 3.12) that writes uploaded JSON to DynamoDB, an S3 event trigger, and an API Gateway GET /items/{id} reading from DynamoDB.
- 平台
lin· Linuxmac· macOS- 应用
- Pulumi · LocalStack
- 交互表面
term· 终端- GUI 需求 · 任务设定
CL· CLI 足够- GUI 需求 · 普通权限
CL· CLI 足够- 交互原语
code· 代码与命令- 工作产物
WP06· 代码 / 工程- 条件
- 未声明
- 提案难度
- 3 / 5
建议验证方式
Grader runs pulumi up: uploading a JSON object results in a DynamoDB item; GET via API Gateway returns it; pulumi preview afterwards shows no changes; IAM policy scoped to the specific table ARN.
建议部分得分
30% resources; 35% end-to-end flow; 20% least-privilege IAM; 15% idempotent
R03.04.01.01-T14 Achieve zero-downtime rolling updates
原始指令
Deployment 'checkout' drops requests during rollouts. Add readiness and startup probes, a preStop hook with graceful shutdown, maxUnavailable 0/maxSurge 25%, and a PodDisruptionBudget so that a rollout and a node drain under constant traffic cause zero failed requests.
- 平台
lin· Linuxmac· macOS- 应用
- kubectl · kind
- 交互表面
term· 终端- GUI 需求 · 任务设定
CL· CLI 足够- GUI 需求 · 普通权限
CL· CLI 足够- 交互原语
code· 代码与命令- 工作产物
WP08· 应用 / 系统状态- 条件
- 未声明
- 提案难度
- 4 / 5
建议验证方式
Grader generates 200 rps while performing a rollout to a new image tag and then draining a node: failed requests must be 0; PDB minAvailable honored; probe settings present.
建议部分得分
45% zero errors during rollout; 35% zero errors during drain; 20% manifests per spec
R03.04.01.01-T15 Harden and sign a container image
原始指令
Rebuild the 'api' image on a distroless base, generate an SPDX SBOM with syft, sign the image and attach the SBOM attestation with cosign (key pair in keys/), push to the local registry at localhost:5000, and add a Kyverno policy that only admits images signed with that key.
- 平台
lin· Linuxmac· macOS- 应用
- Docker · cosign · syft · Kyverno
- 交互表面
term· 终端- GUI 需求 · 任务设定
CL· CLI 足够- GUI 需求 · 普通权限
CL· CLI 足够- 交互原语
code· 代码与命令- 工作产物
WP06· 代码 / 工程- 条件
- 未声明
- 提案难度
- 3 / 5
建议验证方式
Grader: cosign verify and verify-attestation succeed; SBOM lists the app's dependencies; image has no shell (exec sh fails); Kyverno admits the signed image and rejects an unsigned one in the cluster.
建议部分得分
25% distroless image works; 25% signature; 20% SBOM attestation; 30% admission policy
R03.04.01.01-T16 Run Postgres as a StatefulSet with tested backups
原始指令
Deploy Postgres 16 as a StatefulSet with a PVC per pod, a headless Service, and a CronJob that runs pg_dump nightly to a backup PVC keeping 7 copies. Prove restore works by restoring the latest backup into a fresh namespace.
- 平台
lin· Linuxmac· macOS- 应用
- kubectl · kind · PostgreSQL
- 交互表面
term· 终端- GUI 需求 · 任务设定
CL· CLI 足够- GUI 需求 · 普通权限
CL· CLI 足够- 交互原语
code· 代码与命令- 工作产物
WP08· 应用 / 系统状态- 条件
- 未声明
- 提案难度
- 4 / 5
建议验证方式
Grader writes data, triggers the CronJob manually, deletes the StatefulSet pods (data persists), then runs the agent's restore script into a new namespace: data equal. Retention: after 9 triggered runs only 7 dumps remain.
建议部分得分
25% StatefulSet with persistence; 25% backup job; 30% restore verified; 20% retention
R03.04.01.01-T17 Set up a GitOps deployment with Argo CD sync waves
原始指令
Install the provided Argo CD manifests in the kind cluster and create an Application pointing to the local Gitea repo 'platform' path apps/shop, with automated sync, self-heal, prune, and sync waves so the database migrations Job runs before the API Deployment.
- 平台
lin· Linuxmac· macOS- 应用
- Argo CD · kubectl · Gitea
- 交互表面
term· 终端- GUI 需求 · 任务设定
CL· CLI 足够- GUI 需求 · 普通权限
CL· CLI 足够- 交互原语
code· 代码与命令- 工作产物
WP08· 应用 / 系统状态- 条件
- 未声明
- 提案难度
- 4 / 5
建议验证方式
Grader: Application Synced/Healthy; Job completes before Deployment pods start (event timestamps); manual kubectl edit is reverted by self-heal within 3 min; deleting a manifest in git prunes the object.
建议部分得分
30% app synced/healthy; 30% wave ordering; 20% self-heal; 20% prune
R03.04.01.01-T18 Import existing cloud resources into Terraform with zero diff
原始指令
Twelve resources (S3 buckets, IAM roles, an SQS queue, a DynamoDB table) were created by hand in LocalStack. Write Terraform code and import blocks so terraform plan shows no changes after import, without recreating anything.
- 平台
lin· Linuxmac· macOS- 应用
- Terraform · LocalStack
- 交互表面
term· 终端- GUI 需求 · 任务设定
CL· CLI 足够- GUI 需求 · 普通权限
CL· CLI 足够- 交互原语
code· 代码与命令- 工作产物
WP06· 代码 / 工程- 条件
- 未声明
- 提案难度
- 4 / 5
建议验证方式
Grader: terraform plan after import → 'No changes'; state lists all 12 resources; resource ARNs/creation times unchanged; no lifecycle ignore_changes on core attributes (static check).
建议部分得分
40% all 12 imported; 40% zero-diff plan; 20% no ignore_changes shortcuts
R03.04.01.01-T19 Enforce CIS pod-security controls with admission policies
原始指令
Write Kyverno policies enforcing: no privileged containers, runAsNonRoot, read-only root filesystem, dropped ALL capabilities, and required resource limits, in Enforce mode for namespaces labeled env=prod, with an exception for the 'monitoring' namespace's node-exporter.
- 平台
lin· Linuxmac· macOS- 应用
- Kyverno · kubectl
- 交互表面
term· 终端- GUI 需求 · 任务设定
CL· CLI 足够- GUI 需求 · 普通权限
CL· CLI 足够- 交互原语
code· 代码与命令- 工作产物
WP08· 应用 / 系统状态- 条件
- 未声明
- 提案难度
- 3 / 5
建议验证方式
Grader applies 12 test manifests: violating ones rejected in prod namespaces, accepted elsewhere; node-exporter accepted via the exception only; Kyverno policy reports show expected results.
建议部分得分
60% admission matrix correct; 20% exception scoped; 20% policy reports
R03.04.01.01-T20 Deploy one app across two clusters with automatic failover
原始指令
Deploy the 'catalog' service to two kind clusters (east, west) with identical Helm releases, and configure the provided global proxy (Envoy) so traffic prefers east and fails over to west within 10 s when east's deployment is scaled to zero, and back when it recovers.
- 平台
lin· Linux- 应用
- kubectl · Helm · kind · Envoy
- 交互表面
term· 终端- GUI 需求 · 任务设定
CL· CLI 足够- GUI 需求 · 普通权限
CL· CLI 足够- 交互原语
code· 代码与命令- 工作产物
WP08· 应用 / 系统状态- 条件
long· 长流程- 提案难度
- 5 / 5
建议验证方式
Grader runs constant traffic, scales east to 0, then restores it: error rate ≤1% overall, failover ≤10 s and failback ≤30 s measured from response headers; both releases healthy.
建议部分得分
30% both clusters deployed; 40% failover behavior; 20% failback; 10% error budget
已有研究映射
以下沿用研究目录中的基准与小类映射，不是逐题标注、执行记录或产品背书。